@effected/workspaces 0.26.0 → 0.28.0-next-20260927062352

package/ConfigDependencyHooks.js

@@ -1,4 +1,5 @@
 import { normalize } from "./internal/catalogs.js";
+import { makeFetchConfigDependency } from "./internal/configDependencyFetch.js";
 import { lookupPnpmfiles, resolvePnpmfiles } from "./internal/configDependencyResolution.js";
 import { Context, Duration, Effect, Layer, Predicate, Schema } from "effect";
 import { CatalogAssemblyError } from "@effected/npm";
@@ -381,9 +382,10 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	* `links/<name>/<declared>/*\/node_modules/<name>` (the store is located
 	* from `node_modules/.modules.yaml`, the realpath of any `.pnpm-config`
 	* entry, then `$PNPM_HOME` / `$XDG_DATA_HOME` / the platform default), else
-	* a typed error naming the package, the declared version, what is
-	* installed, the stores searched, and the remediation
-	* (`pnpm add --config <name>@<version>` in a throwaway workspace). In the
+	* a typed error with `reason: "notInstalled"` naming the package, the
+	* declared version, what is installed, the stores searched, and the
+	* remediation (`pnpm add --config <name>@<version>` in a throwaway
+	* workspace, or the subprocess layer, which fetches). In the
 	* chosen directory the first of `pnpmfile.mjs`, `pnpmfile.cjs`,
 	* `pnpmfile.js` present in one directory listing is loaded; a listed but
 	* unreadable file fails typed at import time, never as "ships no hook".
@@ -396,9 +398,9 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	* wired by `WorkspaceCatalogs.layerWithConfigDependencies` and the
 	* `Workspaces` composites of the same name.
 	*/
-	static layerLive = Layer.succeed(ConfigDependencyHooks, { inject: (root, configDependencies, seed, rules) => Effect.gen(function* () {
+	static layerLive = Layer.succeed(ConfigDependencyHooks, { inject: (root, configDependencies, seed, rules, context) => Effect.gen(function* () {
 		if (Object.keys(configDependencies).length === 0) return untouched(seed, rules);
-		const pnpmfiles = yield* resolvePnpmfiles(root, configDependencies);
+		const pnpmfiles = yield* resolvePnpmfiles(root, configDependencies, { side: context });
 		return yield* replayInProcess(pnpmfiles, seed, rules);
 	}) });
 	/**
@@ -463,9 +465,24 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	*
 	* The declared-version resolution is the PARENT's: the same ladder as
 	* `layerLive` (`.pnpm-config` when it holds the declared version, else the
-	* pnpm store, else a typed fail-closed error) runs here, and the child
-	* receives the resolved `[name, fileUrl]` pairs as one JSON argv
-	* argument. An empty `configDependencies`, or one whose dependencies all
+	* pnpm store) runs here, and the child receives the resolved
+	* `[name, fileUrl]` pairs as one JSON argv argument.
+	*
+	* One rung more than `layerLive`: a version held nowhere is FETCHED into
+	* the store rather than failing, so a diff whose base side declares a
+	* version this checkout never installed still replays that version. pnpm
+	* runs `install --frozen-lockfile` in a scratch workspace (removed
+	* afterwards) whose lockfile pins the integrity the declaring side recorded
+	* — the inline `<version>+<integrity>` spec, else that side's
+	* `pnpm-lock.yaml` env preamble ({@link HookReplayContext.lockfile}) — so
+	* pnpm itself refuses a download that does not match. It writes to the
+	* first store the ladder searched, so the next replay finds the version
+	* there. The replay records `source: "fetched"`. Fail-closed: two recorded
+	* integrities that disagree fail with `reason: "integrityMismatch"`, none
+	* with `reason: "integrityUnavailable"` — nothing is fetched in either case
+	* — and a fetch that fails with `reason: "fetchFailed"`, keeping the
+	* not-installed remediation. The fetch needs `pnpm` 11 or 12 on `PATH` and
+	* registry access, and is bounded at two minutes. An empty `configDependencies`, or one whose dependencies all
 	* ship no pnpmfile, returns the seed without spawning anything; a `..` path
 	* segment in a dependency name fails typed **before** any spawn; a
 	* load failure in the child — a syntax error, a throwing top level, an
@@ -498,9 +515,13 @@ var ConfigDependencyHooks = class ConfigDependencyHooks extends Context.Service(
 	*/
 	static layerSubprocess = Layer.effect(ConfigDependencyHooks, Effect.gen(function* () {
 		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-		return { inject: (root, configDependencies, seed, rules) => Effect.gen(function* () {
+		const fetch = makeFetchConfigDependency(spawner);
+		return { inject: (root, configDependencies, seed, rules, context) => Effect.gen(function* () {
 			if (Object.keys(configDependencies).length === 0) return untouched(seed, rules);
-			const pnpmfiles = yield* resolvePnpmfiles(root, configDependencies);
+			const pnpmfiles = yield* resolvePnpmfiles(root, configDependencies, {
+				side: context,
+				fetch
+			});
 			const loadable = pnpmfiles.flatMap(({ name, path }) => path === void 0 ? [] : [[name, pathToFileURL(path).href]]);
 			if (loadable.length === 0) return untouched(seed, rules, replaysOf(pnpmfiles));
 			const command = ChildProcess.make("node", [

package/ConfigDependencySpec.js

@@ -0,0 +1,170 @@
+import { splitConfigDependencySpec } from "./internal/configDependencySpecGrammar.js";
+import { Effect, Exit, Option, Result, Schema, SchemaIssue, SchemaTransformation } from "effect";
+import { SriIntegrityHash } from "@effected/npm";
+import { SemVer } from "@effected/semver";
+
+//#region src/ConfigDependencySpec.ts
+/**
+* Indicates that a string could not be parsed as a pnpm `configDependencies`
+* spec (`<version>[+<integrity>]`).
+*
+* Raised by {@link ConfigDependencySpec.parse} and
+* {@link ConfigDependencySpec.parseResult}; the decode direction of
+* {@link ConfigDependencySpec.FromString} reports the same failure through a
+* generic `Schema` parse error carrying the same message. The offending string
+* is preserved on `input`; `reason` says which half failed.
+*
+* @public
+*/
+var InvalidConfigDependencySpecError = class extends Schema.TaggedError()("InvalidConfigDependencySpecError", {
+	/** The raw spec string that failed validation. */
+	input: Schema.String,
+	/**
+	* Which half of the spec failed: `version` (the text before the first
+	* `+` is not an exact SemVer version — ranges, partial versions,
+	* dist-tags and padded values all land here) or `integrity` (the text
+	* after the first `+` is not an SRI `<algo>-<base64>` hash).
+	*/
+	reason: Schema.Literals(["version", "integrity"])
+}) {
+	get message() {
+		return this.reason === "version" ? `Invalid config dependency spec "${this.input}": version must be an exact SemVer version (ranges, partial versions and dist-tags are not allowed)` : `Invalid config dependency spec "${this.input}": integrity must be an SRI <algo>-<base64> hash`;
+	}
+};
+const specVersion = SemVer.pipe(Schema.check(Schema.makeFilter((version) => version.build.length === 0 ? void 0 : "Expected a version without build metadata")));
+/**
+* A pnpm `configDependencies` spec from `pnpm-workspace.yaml`: an exact
+* `version` and, on the legacy inline form only, an SRI `integrity`.
+*
+* @remarks
+* pnpm 11 and later write the **bare** form — `pnpm add --config` records
+* `0.11.1`, and the integrity lives in the lockfile. The inline form
+* `0.11.1+sha512-<base64>` is deprecated but still read, and workspaces in the
+* wild still carry it. {@link ConfigDependencySpec.bare} renders the bare form
+* (a tool normalizing the field writes this); `toString()` re-renders the form
+* that was parsed, so a tool that must not rewrite the field round-trips it
+* byte-identically.
+*
+* The first `+` always begins the integrity, never semver build metadata, so
+* `0.11.1+sha512-…` is version `0.11.1` plus integrity `sha512-…`; a tail that
+* is not an SRI hash fails with `reason: "integrity"` rather than falling back
+* to build-metadata parsing.
+*
+* `version` is `@effected/semver`'s `SemVer`: prerelease versions are
+* accepted, ranges (`^0.11.1`), partial versions, dist-tags, a `v` prefix and
+* padded values are not.
+*
+* @example
+* ```ts
+* import { ConfigDependencySpec } from "@effected/workspaces";
+* import { Effect } from "effect";
+*
+* const program = Effect.gen(function* () {
+*   const spec = yield* ConfigDependencySpec.parse("0.11.1+sha512-m35m…==");
+*   return [spec.bare, spec.hasIntegrity] as const; // ["0.11.1", true]
+* });
+* ```
+*
+* @public
+*/
+var ConfigDependencySpec = class ConfigDependencySpec extends Schema.Class("ConfigDependencySpec")({
+	/**
+	* The exact declared version. Never carries build metadata — the spec
+	* grammar cannot express it (see the class remarks), and a version
+	* constructed with build identifiers is rejected at construction.
+	*/
+	version: specVersion,
+	/**
+	* The inline integrity (e.g. `sha512-m35m…==`): `@effected/npm`'s
+	* `SriIntegrityHash`, the shared restriction of the `IntegrityHash` brand
+	* to the SRI `<algo>-<base64>` form. `None` on the bare form pnpm 11+
+	* writes.
+	*/
+	integrity: Schema.Option(SriIntegrityHash)
+}) {
+	/**
+	* Schema transformation between the `<version>[+<integrity>]` string and a
+	* {@link ConfigDependencySpec}. Decoding parses via
+	* {@link ConfigDependencySpec.parseResult} (the surfaces share one grammar);
+	* encoding prints `toString()`, the form that was parsed.
+	*/
+	static FromString = Schema.String.pipe(Schema.decodeTo(Schema.instanceOf(ConfigDependencySpec), SchemaTransformation.transformEffect({
+		decode: (input) => {
+			const parsed = ConfigDependencySpec.parseResult(input);
+			return Result.isSuccess(parsed) ? Effect.succeed(parsed.success) : Effect.fail(new SchemaIssue.InvalidValue({ message: parsed.failure.message }, input));
+		},
+		encode: (spec) => Effect.succeed(spec.toString())
+	})));
+	/**
+	* Parse a `configDependencies` spec, synchronously, returning a `Result`
+	* instead of an `Effect`.
+	*
+	* @remarks
+	* The text before the first `+` must be an exact SemVer version that
+	* renders back to itself byte for byte (`SemVer.isPinnable`, plus a
+	* canonical-spelling check so `toString()` round-trips); the text after it,
+	* when present, must be an SRI `<algo>-<base64>` hash. An empty tail
+	* (`0.11.1+`) is an integrity failure, not a bare spec.
+	* {@link ConfigDependencySpec.parse} is defined in terms of this function.
+	*
+	* @param input - the spec string to parse
+	* @returns a `Result` succeeding with the parsed {@link ConfigDependencySpec},
+	* or failing with {@link InvalidConfigDependencySpecError} naming the half
+	* that failed.
+	*/
+	static parseResult(input) {
+		const parts = splitConfigDependencySpec(input);
+		const version = SemVer.parseResult(parts.version);
+		if (Result.isFailure(version) || !SemVer.isPinnable(parts.version) || version.success.toString() !== parts.version) return Result.fail(new InvalidConfigDependencySpecError({
+			input,
+			reason: "version"
+		}));
+		if (parts.integrity === void 0) return Result.succeed(ConfigDependencySpec.make({
+			version: version.success,
+			integrity: Option.none()
+		}));
+		const integrity = Schema.decodeUnknownExit(SriIntegrityHash)(parts.integrity);
+		if (Exit.isFailure(integrity)) return Result.fail(new InvalidConfigDependencySpecError({
+			input,
+			reason: "integrity"
+		}));
+		return Result.succeed(ConfigDependencySpec.make({
+			version: version.success,
+			integrity: Option.some(integrity.value)
+		}));
+	}
+	/**
+	* Parse a `configDependencies` spec. Defined in terms of
+	* {@link ConfigDependencySpec.parseResult} — synchronous callers can use
+	* that variant directly.
+	*
+	* @param input - the spec string to parse
+	* @returns the parsed {@link ConfigDependencySpec}. Fails with
+	* {@link InvalidConfigDependencySpecError} when `input` is not a valid spec.
+	*/
+	static parse = Effect.fn("ConfigDependencySpec.parse")((input) => Effect.fromResult(ConfigDependencySpec.parseResult(input)));
+	/** Whether the spec carries an inline integrity (the legacy form). */
+	get hasIntegrity() {
+		return Option.isSome(this.integrity);
+	}
+	/**
+	* The bare `<version>` form — what pnpm 11+ writes to `configDependencies`
+	* — with any inline integrity dropped.
+	*/
+	get bare() {
+		return this.version.toString();
+	}
+	/**
+	* The spec as parsed: `<version>` or `<version>+<integrity>`. The encode
+	* direction of {@link ConfigDependencySpec.FromString} prints exactly this.
+	*/
+	toString() {
+		return Option.match(this.integrity, {
+			onNone: () => this.bare,
+			onSome: (integrity) => `${this.bare}+${integrity}`
+		});
+	}
+};
+
+//#endregion
+export { ConfigDependencySpec, InvalidConfigDependencySpecError };